engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/handbrake/patch/CLEAN.md
russell@unturf.com 178d9c03db scan: HandBrake + Emacs CWE-407 — both CLEAN 
HandBrake: libhb uses array-backed lists bounded by media metadata
sizes (tracks, subtitles, chapters, presets). No user-controlled
quadratic growth path found.

Emacs: C core uses Fmemq/Fmember on small bounded lists (property
lists, error conditions, flags). Larger lists (features ~1000,
charsets ~200) only scanned in non-hot-path code. Elisp delete-dups
already has hash optimization for >100 elements.
2026-03-30 11:45:36 -04:00

1.5 KiB
Raw Permalink Blame History

HandBrake — CWE-407 Scan Result: CLEAN

Date: 2026-03-30 Target: HandBrake (C, libhb + macOS/Windows GUI) Source: https://github.com/HandBrake/HandBrake (depth=1)

Scan Summary

Scanned libhb/ (82 C files), macosx/ (Objective-C GUI), win/CS/ (C# WPF GUI).

Areas Examined

  • hb_list_t operations: Array-backed list used for audio tracks (1-8), subtitles (1-10), chapters (5-50), presets (<100). hb_list_rem() does linear search + memmove but on inherently small, bounded collections.
  • preset.c language lookups: find_audio_track() / find_subtitle_track() O(L×T) where L = user language count (1-3) and T = tracks (<50). Not exploitable.
  • preset.c fix_name_collisions(): O(N×J) restart loop for name collision, but N = preset count and J = collision count, both small.
  • stream.c transport stream dedup: Compares against single previous packet summary. O(1).
  • common.c encoder fallback resolution: O(encoders²) but encoder count is fixed (~20-30). Not user-controlled.
  • macOS GUI: NSMutableSet already used for destination dedup. indexOfObject calls on queue items operate on user selection (small).
  • C# WPF GUI: PortService.usedPorts is List<int> but bounded by concurrent encode count (typically 1-4).

Conclusion

HandBrake's list operations are consistently bounded by media metadata sizes (tracks, subtitles, chapters, presets) which are inherently small. No user-controlled input can cause quadratic growth. No CWE-407 defect found.